ClawHub
Back to skill

Security audit

ChatGPT Image Tailnet

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for remote ChatGPT image generation, but it controls a remote browser session through a broadly trusted tailnet HTTP API without clear endpoint-level safeguards.

Install only if you own and trust the tailnet browser host, its ChatGPT session, and the network controls around port 9377. Treat prompts and generated images as sent through that remote browser and saved to disk; restrict tailnet ACLs/firewall rules and avoid sensitive prompts unless endpoint authentication and session isolation are added.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/chatgpt_image_tailnet.py:13
Finding

Unauthenticated Remote Browser Control over Plain HTTP

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/chatgpt_image_tailnet.py:139
Finding

Predictable Shared Session Identity and Uncorrelated Download Consumption

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/chatgpt_image_tailnet.py (reported line 167)May include surrounding context.

python
e": item.get("mimeType"),
                "bytes": item.get("bytes"),
            }
        time.sleep(1)
    raise RuntimeError("No download captured from generated image")


def default_output_path():
    ts = datetime.now(UTC).strftime("%Y%m%d-%H%M%S")
    return os.path.join(os.path.dirname(__file__), "..", "generated", f"chatgpt-image-{ts}.png")


def main():
    ap = argparse.ArgumentParser(description="Generate and download a ChatGPT image through the remote Camoufox browser")
    ap.add_argument("prompt", help="Prompt to send to ChatGPT image generation")
    ap.add_argument("--base", default=DEFAULT_BASE)
    ap.add_argument("--user", default="lotfi")
    ap.add_argument("--session", default="chatgpt-image-helper")
    ap.add_argument("--output", default=None)
    ap.add_argument("--timeout", type=int, default=180)
    args = ap.parse_args()

    output = os.path.abspath(args.output or default_output_path())
    try:
        tab = open_tab(args.base, args.user, args.session, C

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill instructs use of a remote browser over a tailnet IP and performs networked actions, but the manifest declares no explicit tool scope or allowed-tools restrictions. That weakens least-privilege controls and can cause the agent to invoke broader network capabilities than a user would reasonably expect, especially when interacting with a remote residential browser and external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly describes downloading generated images and saving or sending them, but the user-facing description does not clearly warn that files will be written to disk. This can surprise users, lead to unintended storage of potentially sensitive or policy-relevant content, and increase risk if saved files are later accessed, synced, or retained longer than expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script sends user-provided prompt content through remote browser-control HTTP endpoints and then to ChatGPT, but the code does not provide a visible warning, confirmation, or privacy notice about that transmission. Network transmission of user data is in scope for missing-warning checks on code files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code creates directories and writes a downloaded image file to the local filesystem, but there is no confirmation prompt, warning comment, docstring disclosure, or user-facing log indicating that a file will be created. For a code file, file writes are safety-relevant operations that should have some visible disclosure unless clearly disclosed elsewhere.

Content

No source excerpt is available for this finding.